Academia.eduAcademia.edu

Cryptanalysis of Lee–Hwang–Yang blind signature scheme

2009, Computer Standards & Interfaces

In 2005, Lee et al. proposed a blind signature scheme based on the discrete-logarithm problem to achieve the untraceability or unlinkability property. However, the scheme will be demonstrated as not being secure in this manuscript. We design an attack on the scheme such that a signature requester can obtain more than one valid signatures by performing only one round of the protocol. It violates an important security requirement of blind signatures.

Cryptanalysis of Lee-Hwang-Yang Blind Signature Scheme Chun-I Fan, D. J. Guan, Chih-I Wang, and Dai-Rui Lin Department of Computer Science and Engineering National Sun Yat-sen University, Kaohsiung 804, Taiwan {cifan, guan}@cse.nsysu.edu.tw Abstract In 2005, Lee et al. proposed a blind signature scheme based on the discrete-logarithm problem to achieve the untraceability or unlinkability property. However, the scheme will be demonstrated as not being secure in this manuscript. We design an attack on the scheme such that a signature requester can obtain more than one valid signatures by performing only one round of the protocol. It violates an important security requirement of blind signatures. Keywords : Blind Signatures, Unlinkability, Untraceability, Security & Privacy, Cryptography 1 Introduction In 1982, Chaum proposed the concept of blind signatures [1], which makes it information theoretically impossible for a signer to derive the link between a signature and the instance of the signing operation that produced the blinded form of the signature. This is usually referred to as the unlinkability or untraceability property. Due to the unlinkability property and the unforgeabilty of the signatures, blind signatures have been widely applied to untraceable electronic cash protocols [1][3] and anonymous electronic voting systems [4][8]. Recently, several blind signature schemes based on the discrete-logarithm problem have been proposed and discussed in [2][5][6][7]. In 1994, Carmenish et al. [2] introduced a blind signature scheme based on the discrete-logarithm problem. In 1995, Harn [5] pointed out that Carmenish et al.’s scheme cannot satisfy the requirement of untraceability. However, Horster et al. [6] claimed that Harn’s cryptanalysis is not correct. Later, in 2005, Lee et al. [7] show that Horster et al.’s comment on Harn’s attack [5] is wrong. Thus, they proposed an improved blind signature scheme in [7] to enhance the security of Carmenish et al.’s scheme for withstanding the attack introduced in [5]. In a secure blind signature scheme, it must be guaranteed that any signature requester can acquire at most w signatures if the requester performs w rounds of the protocol with the signer where w is a positive integer [1][3][4]. In this manuscript, we will show that there exists a security flaw in the scheme of [7] such that a signature requester can obtain two valid signatures by performing only one round of the protocol with the signer. It turns out that the scheme of [7] is insecure. The rest of this paper is organized as follows. In the next section, we briefly review Lee-HwangYang scheme of [7]. The proposed attack is presented in Section 3. Finally, a concluding remark is given in Section 4. 2 Review of Lee-Hwang-Yang Blind Signature Scheme In this section, we briefly review the blind signature scheme proposed by Lee, Hwang, and Yang [7]. There are two kinds of roles in the scheme: a signer and a group of signature requesters, where signature requesters request signatures from the signer and the signer issues blind signatures to the requesters. The details of [7] are described as follows: Initially, the signer chooses two large primes (p, q) and an integer g where q|(p − 1) and g is a generator with order q in Zp∗ . The signer selects an integer x as its secret key and computes y = g x mod p. It publishes (p, q, g, y). The signer randomly chooses ke1 , ke2 , b1 , b2 ∈ Zq f f and computes re1 = g k1 mod p and re2 = g k2 mod p such that GCD(re1 , q) = GCD(re2 , q) = 1. Then, the signer sends re1 , re2 , b1 , b2 to a requester. After receiving (re1 , re2 , b1 , b2 ) from the signer, the reque-